Data protection & privacy law in Austria (2026)

Legal framework

EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) directly applicable, supplemented and implemented nationally by the Austrian Federal Data Protection Act (Datenschutzgesetz — DSG, BGBl. I Nr. 165/1999 as most recently amended by BGBl. I Nr. 70/2024). Supervised by the Austrian Data Protection Authority (Datenschutzbehörde — DSB).

GDPR & data protection in Austria

In Austria, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Austrian Data Protection Authority (Datenschutzbehörde).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Austrian Data Protection Authority (Datenschutzbehörde)

Applies to

any organisation processing the personal data of people in Austria, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Austria supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Austria

1. 01Primary legal framework

   GDPR applies directly since 25 May 2018; the DSG (as amended, latest consolidated version BGBl. I Nr. 70/2024) implements national opening clauses, contains the constitutional Grundrecht auf Datenschutz (§ 1 DSG), and sets out rules on the DSB, judicial data processing, employer/employee data, video surveillance, and criminal-law data processing.

   data-protection-authority.gv.at ris.bka.gv.at

2. 02Supervisory authority

   The Datenschutzbehörde (DSB), Barichgasse 40-42, 1030 Vienna, is the independent supervisory authority under Art. 51 GDPR. It handles complaints, conducts investigations, issues corrective measures and administrative fines; its 2026 budget is approximately EUR 5.9 million, with around 53 staff.

   data-protection-authority.gv.at cms.law

3. 03Enforcement and fines

   The DSB may order cessation of unlawful processing and impose GDPR fines up to EUR 20 million or 4% of worldwide annual turnover (Art. 83 GDPR), plus DSG-specific administrative fines up to EUR 50,000. Notable recent decisions include the EUR 16 million fine confirmed against Österreichische Post in December 2024 by the Federal Administrative Court.

   enforcementtracker.com cms.law

4. 04Data subject rights and complaints

   Data subjects enjoy full GDPR rights (access, rectification, erasure, restriction, portability, objection) plus the § 1 DSG constitutional right to data secrecy, and may lodge complaints with the DSB free of charge. Following CJEU ruling C-416/23 (9 January 2025), the DSB may not arbitrarily cap the number of complaints a data subject can file.

   data-protection-authority.gv.at noyb.eu

5. 05Breach notification

   Controllers must notify the DSB of personal-data breaches without undue delay and, where feasible, within 72 hours (Art. 33 GDPR), and inform affected data subjects where there is a high risk to their rights (Art. 34 GDPR). Failure to notify can trigger fines up to EUR 10 million or 2% of global turnover.

   dlapiperdataprotection.com cms.law

6. 06Recent 2024–2025 developments

   The DSG was amended in June and July 2024 (BGBl. I 2024/62 and 2024/70) in response to CJEU C-33/22 (16 January 2024), creating a separate Parlamentarisches Datenschutzkomitee that took over supervision of legislative bodies on 1 January 2025. The EU Data Act (Regulation (EU) 2023/2854) became directly applicable across Austria on 12 September 2025, adding data-access and data-sharing obligations.

   parlament.gv.at data-protection-authority.gv.at

GDPR in Austria: FAQ

Timeline of decisions

1. 26 Nov 2025Decision
   Austrian Supreme Court rules Meta's personalized-ad model unlawful, orders full data access

   In case 6 Ob 189/24y (announced 18 Dec 2025), the OGH ended an 11-year Schrems case, finding Meta's targeted-ad processing required specific consent and ordering Meta to disclose all of a user's personal data including sources and purposes. It set a binding GDPR precedent on consent and access rights across the EU.

   noyb

2. 25 Sept 2025Decision
   DSB finds credit agency KSV1870's automated scoring unlawful

   The Austrian Data Protection Authority ruled that KSV1870's fully automated scoring used to deny consumers energy contracts constituted prohibited automated individual decision-making under Article 22 GDPR. It reinforced limits on algorithmic decisioning in Austria.

   E+H Rechtsanwälte

3. 1 Jul 2025Guidance
   DSB cuts operations amid budget constraints

   Facing a 769% rise in complaints since 2017 (3,813 in 2024) but flat funding, the Austrian Data Protection Authority imposed operational restrictions from July 2025. It signaled a growing gap between enforcement demand and regulator capacity.

   PPC Land

4. 27 Dec 2024Enforcement
   BVwG imposes EUR 16 million fine on Österreichische Post

   After awaiting the CJEU's Deutsche Wohnen ruling, the Federal Administrative Court confirmed a EUR 16 million fine against the Austrian Postal Service for GDPR violations tied to profiling. It is among the largest GDPR penalties ever issued in Austria.

   CMS GDPR Enforcement Tracker

5. 10 May 2023Enforcement · official
   Austrian DPA rules Clearview AI facial recognition unlawful

   The Datenschutzbehörde found Clearview AI's scraping of facial images and biometric profiling breached GDPR Articles 5, 6, 9 and 27, ordering deletion of the complainant's data, an early Austrian limit on AI-driven biometric surveillance (though no fine was issued).

   EDPB

6. 13 Jan 2022Decision
   DSB rules Google Analytics transfers to the US unlawful

   In the first decision on noyb's 101 post-Schrems II model complaints, the DSB held that exporting Google Analytics data to the US breached GDPR Chapter V because standard contractual clauses could not protect against US FISA 702 surveillance. It triggered a wave of similar rulings across EU regulators.

   noyb

7. 25 May 2018Law · official
   Austrian Data Protection Act (DSG) takes effect alongside the GDPR

   The amended Datenschutzgesetz entered into force with the GDPR, establishing the Datenschutzbehörde and national rules that underpin data-security and breach-notification obligations relevant to cybersecurity.

   Austrian Data Protection Authority

8. 25 May 2018Law · official
   New Datenschutzgesetz (DSG) and GDPR take effect in Austria

   The revised Data Protection Act entered into force alongside the EU GDPR, restructuring the national framework while retaining the constitutional Section 1 right to data secrecy. It is the central national statute supplementing the GDPR today.

   RIS (Federal Legal Information System)

9. 31 Jul 2017Law · official
   Datenschutz-Anpassungsgesetz 2018 adopted to implement GDPR opening clauses

   Published as BGBl I No. 120/2017, the Data Protection Amendment Act 2018 exercised the GDPR's national discretionary powers and overhauled the DSG ahead of 25 May 2018. A government attempt to abolish the constitutional data-protection right failed for lack of a two-thirds majority.

   Parlament Österreich

10. 18 Oct 1978Law
    First Datenschutzgesetz (DSG 1978) establishes a constitutional right to data protection

    Austria's original Data Protection Act (BGBl No. 565/1978) enshrined a constitutional right to data secrecy in Section 1 and created the Data Protection Commission, one of the earliest such authorities worldwide. This constitutional anchor still underpins the modern framework.

    GDPRhub

Sources

1. 1.data-protection-authority.gv.at/
2. 2.data-protection-authority.gv.at/data-protection-laws/relevant-data-protection-laws
3. 3.data-protection-authority.gv.at/data-protection-in-austria/rights-of-the-data-subject
4. 4.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597
5. 5.parlament.gv.at/en/services/help/privacy
6. 6.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
7. 7.cms.law/en/gbr/publication/gdpr-enforcement-tracker-report/austria
8. 8.dlapiperdataprotection.com/index.html?t=breach-notification&c=AT
9. 9.enforcementtracker.com/ETid-2938
10. 10.noyb.eu/en/austrian-data-protection-authority-slammed-cjeu